December 2009 - Freeradius-Users - lists.freeradius.org

FreeRADIUS Server version 2.1.8 problem with Debian 5 64bit
by piston 31 Dec '09

31 Dec '09

Hi Alan Trying to compile at my Debian 5 64bit server but fail. No issue during compiling pre 2.1.8. dpkg-buildpackage -b -uc dpkg-buildpackage: set CFLAGS to default value: -g -O2 dpkg-buildpackage: set CPPFLAGS to default value: dpkg-buildpackage: set LDFLAGS to default value: dpkg-buildpackage: set FFLAGS to default value: -g -O2 dpkg-buildpackage: set CXXFLAGS to default value: -g -O2 dpkg-buildpackage: source package freeradius dpkg-buildpackage: source version 2.1.8+git dpkg-buildpackage: source changed by Josip Rodin <joy-packages(a)debian.org> dpkg-buildpackage: host architecture amd64 dpkg-checkbuilddeps: Unmet build dependencies: quilt dpkg-buildpackage: warning: Build dependencies/conflicts unsatisfied; aborting. dpkg-buildpackage: warning: (Use -d flag to override.) dpkg-buildpackage -b -uc -d dpkg-buildpackage: set CFLAGS to default value: -g -O2 dpkg-buildpackage: set CPPFLAGS to default value: dpkg-buildpackage: set LDFLAGS to default value: dpkg-buildpackage: set FFLAGS to default value: -g -O2 dpkg-buildpackage: set CXXFLAGS to default value: -g -O2 dpkg-buildpackage: source package freeradius dpkg-buildpackage: source version 2.1.8+git dpkg-buildpackage: source changed by Josip Rodin <joy-packages(a)debian.org> dpkg-buildpackage: host architecture amd64 debian/rules clean debian/rules:52: /usr/share/quilt/quilt.make: No such file or directory make: *** No rule to make target `/usr/share/quilt/quilt.make'. Stop. dpkg-buildpackage: failure: debian/rules clean gave error exit status 2 KH

3 3

new 2.1.8 rpm packages available for Fedora
by John Dennis 31 Dec '09

31 Dec '09

The latest stable version of FreeRADIUS (2.1.8) was released yesterday by Alan DeKok. 2.1.8 rpm packages are now available for Fedora in the rawhide(e.g. devel) repository and the F-12 updates testing repository. I will move the F-12 version from testing to stable when the build has gotten several positive comments or two weeks have elapsed, whichever comes first. To comment on the build use this URL: https://admin.fedoraproject.org/updates/freeradius-2.1.8-1.fc12?_csrf_token… -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

1 0

sql accounting not working for realms
by Taylor, Chris 31 Dec '09

31 Dec '09

I am running FreeRadius ver 1.1.3, and have LDAP setup for authentication and MySQL for logging. I have a few realms setup as we have two NAS devices one sends stripped usernames (Nortel Shasta), the other sends non-stripped usernames(Cisco ASR). Anything that comes in with a stripped username will end up in the NULL realm and be both authenticated via LDAP and logged into MySQL. Anything that comes in with a username of username(a)domain.net just gets authenticated, not logged. I am sure that it's just a configuration issue but I can figure out where, and have searched the archive without any luck. Any help would be appreciated. Below are my startup debug proxy.conf, and two examples of what is happening. Proxy.conf ########################################### proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = no } realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } realm NULL { type = radius authhost = LOCAL accthost = LOCAL } realm domain.net { type = radius authhost = LOCAL accthost = LOCAL strip } ########################################### Startup Debug Radius.conf ########################################### realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no accounting { acct_unique #detail sql } ########################################### [root@ns1 ~]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/sql.conf Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "mysql-db.domain.net" sql: port = "" sql: login = "XXXX" sql: password = "XXXX" sql: radius_db = "radius" sql: nas_table = "nas" sql: sqltrace = no sql: sqltracefile = "/var/log/radius/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 10 sql: sql_user_name = "%{Stripped-User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgrou pcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrou preply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = %{Acct-Delay-Time} WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStopTime = 0" sql: accounting_update_query_alt = "" sql: accounting_start_query = "INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('', '%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime = 0" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime = 0" sql: accounting_stop_query_alt = "INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('', '%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '0', '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 2 sql: simul_count_query = "SELECT COUNT(*) FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_query = "" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to XXX@mysql-db.domain.net:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_mysql #5 rlm_sql_mysql: Starting connect to MySQL server for #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_mysql #6 rlm_sql_mysql: Starting connect to MySQL server for #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_mysql #7 rlm_sql_mysql: Starting connect to MySQL server for #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): starting 8 rlm_sql (sql): Attempting to connect rlm_sql_mysql #8 rlm_sql_mysql: Starting connect to MySQL server for #8 rlm_sql (sql): Connected new DB handle, #8 rlm_sql (sql): starting 9 rlm_sql (sql): Attempting to connect rlm_sql_mysql #9 rlm_sql_mysql: Starting connect to MySQL server for #9 rlm_sql (sql): Connected new DB handle, #9 Module: Instantiated sql (sql) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = no radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. ################################################################## Connection from CISCO with full username ######################################################################## ################## rad_recv: Access-Request packet from host X.X.X.X:1645, id=218, length=105 Framed-Protocol = PPP User-Name = "username1(a)domain.net" User-Password = "userpasswd" NAS-Port-Type = Virtual NAS-Port = 0 NAS-Port-Id = "1/0/5/241" Service-Type = Framed-User NAS-IP-Address = X.X.X.X rad_lowerpair: User-Name now 'username(a)domain.net' rad_rmspace_pair: User-Name now 'username1(a)domain.net' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 58 modcall[authorize]: module "preprocess" returns ok for request 58 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 172 users: Matched entry DEFAULT at line 183 modcall[authorize]: module "files" returns ok for request 58 rlm_realm: Looking up realm "domain.net" for User-Name = "username1(a)domain.net" rlm_realm: Found realm "domain.net" rlm_realm: Adding Stripped-User-Name = "username1" rlm_realm: Proxying request from user username1 to realm domain.net rlm_realm: Adding Realm = "domain.net" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 58 modcall: entering group redundant for request 58 rlm_ldap: - authorize rlm_ldap: performing user authorization for username1 radius_xlat: '(&(objectClass=posixAccount)(uid=username1))' radius_xlat: 'dc=domain, dc=net' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=domain, dc=net, with filter (&(objectClass=posixAccount)(uid=username1)) rlm_ldap: checking if remote access for username1 is allowed by cn rlm_ldap: Added password 1975 in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusSimultaneousUse as Simultaneous-Use, value 99 & op=21 rlm_ldap: Adding radiusAuthType as Auth-Type, value local & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user usename1 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 58 modcall: leaving group redundant (returns ok) for request 58 modcall: leaving group authorize (returns ok) for request 58 rad_check_password: Found Auth-Type local auth: type Local auth: user supplied User-Password matches local User-Password Processing the session section of radiusd.conf modcall: entering group session for request 58 radius_xlat: '/var/log/radius/radutmp' modcall[session]: module "radutmp" returns ok for request 58 modcall: leaving group session (returns ok) for request 58 Login OK: [username1] (from client bari-bras1 port 0) Sending Access-Accept of id 218 to 24.139.16.70 port 1645 Framed-IP-Address = 255.255.255.254 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Finished request 58 ######################################################################## ###################### Connection from Shasta with stripped username ######################################################################## ####################### Going to the next request ad_recv: Accounting-Request packet from host X.X.X.X.:49157, id=108, length=178 Acct-Status-Type = Start User-Name = "username2" Event-Timestamp = "Dec 30 2009 09:09:14 EST" Service-Type = Framed-User NAS-IP-Address = X.X.X.X Shasta-Attr-4 = 0x53686173746120353030303a2069534f532028746d292c20352e342e3000 NAS-Port = 721420288 Shasta-Attr-9 = 0x30303a31383a66333a32383a63643a3731 Shasta-Attr-10 = 0x0000a572 Acct-Session-Id = "1d069021" Acct-Authentic = RADIUS Framed-IP-Address = 67.58.205.173 Framed-IP-Netmask = 255.255.255.255 Calling-Station-Id = "aylm05300000000" rad_lowerpair: User-Name now 'username2' rad_rmspace_pair: User-Name now 'username2' Processing the preacct section of radiusd.conf modcall: entering group preacct for request 63 modcall[preacct]: module "preprocess" returns noop for request 63 rlm_realm: No '@' in User-Name = "username2", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "username2" rlm_realm: Proxying request from user username2 to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Accounting realm is LOCAL. modcall[preacct]: module "suffix" returns noop for request 63 modcall[preacct]: module "files" returns noop for request 63 modcall: leaving group preacct (returns noop) for request 63 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 63 rlm_acct_unique: Hashing 'NAS-Port = 721420288,Client-IP-Address = X.X.X.X,NAS-IP-Address = 67.58.194.98,Acct-Session-Id = "1d069021",User-Name = "username2"' rlm_acct_unique: Acct-Unique-Session-ID = "e781a2ca4624e026". modcall[accounting]: module "acct_unique" returns ok for request 63 radius_xlat: 'username2' rlm_sql (sql): sql_set_user escaped user --> 'username2' radius_xlat: 'INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('', '1d069021', 'e781a2ca4624e026', 'username2', 'NULL', 'X.X.X.X', '721420288', '', '2009-12-30 09:08:55', '0', '0', 'RADIUS', '', '', '0', '0', '', 'aylm05300000000', '', 'Framed-User', '', '67.58.205.173', '', '0')' rlm_sql (sql): Reserving sql socket id: 5 rlm_sql (sql): Released sql socket id: 5 modcall[accounting]: module "sql" returns ok for request 63 modcall: leaving group accounting (returns ok) for request 63 Sending Accounting-Response of id 108 to X.X.X.X port 49157 Finished request 63 ######################################################################## ############################ Thanks, Chris

1 0

Re: OpenVPNAS Accounting Issues
by Neville 31 Dec '09

31 Dec '09

> > Neville wrote: >> I would just like to clarify the accepted format of Acct-Session-Id, when >> using mySQL to track the clients usage through accounting. > > It's a string. > >> I'm currently testing OpenVPNAS and it seems to create a long string >> such as >> 'NASIPADDRESS.as0t0.1261084262.6899.1', however when the >> 'Acct-Status-Type': >> 'Stop' is sent, the SQL does not update the current row, but instead >> creates >> a NEW row, which seems identical, therefore leaving the session open in >> sql. > > Because the NAS isn't sending the same information in "stop" as it > sent in "start". > >> Is the problem with the STRING being used by OpenVPNAS the reason why the >> original ROW created by 'Acct-Status-Type': 'Start' is not being updated? > > No. > > As always, run the server in debugging mode to see what's happening. > > Alan DeKok. > Thanks Alan, acctsessionid field was limited to vchar(32), increased to vchar(64) and all is working correctly. Thx Nev

1 0

Re: OpenVPNAS Accounting Issues
by Neville 31 Dec '09

31 Dec '09

> > Neville wrote: >> I would just like to clarify the accepted format of Acct-Session-Id, when >> using mySQL to track the clients usage through accounting. > > It's a string. > >> I'm currently testing OpenVPNAS and it seems to create a long string >> such as >> 'NASIPADDRESS.as0t0.1261084262.6899.1', however when the >> 'Acct-Status-Type': >> 'Stop' is sent, the SQL does not update the current row, but instead >> creates >> a NEW row, which seems identical, therefore leaving the session open in >> sql. > > Because the NAS isn't sending the same information in "stop" as it > sent in "start". > >> Is the problem with the STRING being used by OpenVPNAS the reason why the >> original ROW created by 'Acct-Status-Type': 'Start' is not being updated? > > No. > > As always, run the server in debugging mode to see what's happening. > > Alan DeKok. > Thanks Alan, acctsessionid field was limited to vchar(32), increased to vchar(64) and all is working correctly. Thx Nev

1 0

Recall: MAC authentication bypass --- How am Isupposedto?edit?theusersfile to include multiple MAC addresses??
by Difan Zhao 31 Dec '09

31 Dec '09

Difan Zhao would like to recall the message, "MAC authentication bypass --- How am Isupposedto?edit?theusersfile to include multiple MAC addresses??".

3 6

freeradius2 Load-Balance Issue
by Brian Carpio 30 Dec '09

30 Dec '09

Hi, I am using FreeRADIUS Version 2.1.7, this is the RPM for RHEL made available from (http://people.redhat.com/jdennis/freeradius-rhel-centos) which was linked by the RedHat FAQ on the FreeRadius Wiki (actually I downloaded the .srpm and change the .spec file to include --with-udpfromto in the configure line). Anyway I seem to have an odd issue. I have two home servers configured with the below proxy.conf, the issue is when both server1 and server2 are up load balancing works fine when I take down server 1 it goes into zombie then it is marked dead which is all great (I posted those messages below as well), then when I bring server 1 back online FreeRadius' status_check sees the server up ( I posted that message below as well) however no more Radius requests go to server1 (not unless I take server2 down then I can see server1 starts to receive the requests) but it seems like either there is a bug or I have something mis configured because I would assume once the status_check notices server1 is back online it should start to receive radius requests again.. home_server server1 { type = auth+acct ipaddr = XXX.XXX.XXXX.XXXX port = 1812,1813 secret = secret require_message_authenticator = no response_window = 20 zombie_period = 10 # revive_interval = 120 status_check = request username = username(a)host.com password = secret check_interval = 5 num_answers_to_alive = 3 } home_server server2 { type = auth+acct ipaddr = XXX.XXX.XXX.XXX port = 1812,1813 secret = secret require_message_authenticator = no response_window = 20 zombie_period = 10 # revive_interval = 120 status_check = request username = username(a)host.com password = secret check_interval = 5 num_answers_to_alive = 3 } home_server_pool balance { type = load-balance home_server = pcrf01 home_server = pcrf02 } realm DEFAULT { pool = balance nostrip } ------------------ end proxy.conf -------------------- ------ DEAD SERVER -------------------- PROXY: Marking home server XXX.XXX.XXX.XXX port 1812 as zombie (it looks like it is dead). Sending Access-Request of id 222 to XXX.XXX.XXX.XXX port 1812 User-Name := "username(a)host.com" User-Password := "secret" Service-Type := Authenticate-Only Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 3.9 seconds. Waking up in 4.3 seconds. ---------- end DEAD SERVER ------------ ------ Server Alive ----------------- rad_recv: Access-Accept packet from host XXX.XXX.XXX.XXX port 1812, id=185, length=20 Waking up in 10.0 seconds. --------- end Server Alive -------------

2 2

Need outside support
by Michael Joyner 30 Dec '09

30 Dec '09

I apologize in advance to those who might consider this a form of advertising, but I've searched high and low in many other places and I'm quickly running out of time and options. My company needs immediate FreeRADIUS deployment and there have been a number of issues arising and our server is not accepting packets. I am more than willing to pay someone here by the hour to give me advice by phone. If you're interested, please contact me off-list via email or by phone at +1 626-840-1633 or michaelwjoyner_at_gmail.com

1 0

FreeRADIUS Server version 2.1.8 has been released
by Alan DeKok 30 Dec '09

30 Dec '09

We have released version 2.1.8 of the server, which is the final version of the 2.1.x series. We will release 2.1.9 only if there are major bugs or security problems with 2.1.8. This version is targeted towards bug fixes. New features have been kept to a minimum, with the goal of making a highly stable release. One major change in 2.1.8 is a license change to permit distribution of binaries linked to OpenSSL. This allows Debian && Ubuntu systems to ship a version with EAP enabled, which will make it much easier to install FreeRADIUS on those systems. In the new year, we will release version 2.2.0 of the server. This version will include many new features, such as support for RADIUS over TCP, and potentially many other useful things! The complete change log for 2.1.8 is below Alan DeKok. -- Feature improvements * Print more descriptive error message for too many EAP sessions. This gives hints on what to do when "failed to store handler" * Commands received from radmin are now printed on stdout when in debugging mode. * Allow accounting packets to be written to a detail file, even if they were read from a different detail file. * Added OpenSSL license exception (src/LICENSE.openssl) Bug fixes * DHCP sockets can now set the broadcast flag before binding to a socket. You need to set "broadcast = yes" in the DHCP listener. * Be more restrictive on string parsing in the config files * Fix password length in scripts/create-users.pl * Be more flexible about parsing the detail file. This allows it to read files where the attributes have been edited. * Ensure that requests read from the detail file are cleaned up (i.e. don't leak) if they are proxied without a response. * Write the PID file after opening sockets, not before (closes bug #29) * Proxying large numbers of packets no longer gives error "unable to open proxy socket". * Avoid mutex locks in libc after fork * Retry packet from detail file if there was no response. * Allow old-style dictionary formats, where the vendor name is the last field in an ATTRIBUTE definition. * Removed all recursive use of mutexes. Some systems just don't support this. * Allow !* to work as documented. * make templates work (see templates.conf) * Enabled "allow_core_dumps" to work again * Print better errors when reading invalid dictionaries * Sign client certificates with CA, rather than server certs. * Fix potential crash in rlm_passwd when file was closed * Fixed corner cases in conditional dynamic expansion. * Use InnoDB for MySQL IP Pools, to gain transactional support * Apply patch to libltdl for CVE-2009-3736. * Fixed a few issues found by LLVM's static checker * Keep track of "bad authenticators" for accounting packets * Keep track of "dropped packets" for auth/acct packets * Synced the "debian" directory with upstream * Made "unlang" use unsigned 32-bit integers, to match the dictionaries.

1 0

Performance issues
by Alan DeKok 30 Dec '09

30 Dec '09

I've written some tools to debug the performance issues that people have seen. Part of it is set of patches to the server that has it print out a *lot* of information about what it's doing. The second part of the tool is a script that processes the output, and generates pretty graphs. See the following URL for an example: http://git.freeradius.org/processing.png This was created by running 1000 packets through the server, then collecting and analyzing the data. The graph is an average over all requests. The interpretation of the graph is: - the average request takes ~0.022 seconds - it is put into a queue for a bit - then pulled off by a thread and processed - then run through the "authorize" section - the delay before running the "authorize" section is due to the decoding of binary packet to internal attributes - a number of modules are run - "authenticate" is skipped, as the test set "Auth-Type := Accept" - the post-auth section is run - which runs the "exec" module. - the server replies, and the request is marked "finished" We can quickly see here where all of the CPU time is spent. This tool should hopefully let people track down *where* the performance problems are located. Email me off list if you are interested. I'm not sure that this will go into an official release, because it's pretty invasive. Alan DeKok.

1 0